House Price - 房价

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:32 PM UTC
• Version:
  1.0.1

Overview

This skill is a disclosed house-price lookup tool that fetches public Fangjia pages and can optionally write a chart file, with no evidence of hidden persistence, credential use, or destructive behavior.

Install if you are comfortable with a Python script making outbound requests to Fangjia and optionally writing an HTML chart when requested. Prefer city slugs or Fangjia URLs, avoid arbitrary --url values, and choose chart output paths carefully.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger description includes broad catch-all phrasing such as handling '类似城市房价问题时' and '给个查房价链接', which can overlap with ordinary conversation and cause unintended invocation. Because this skill can initiate web requests and optionally write files through `get.py`, accidental triggering increases the risk of unnecessary external access and tool execution in contexts the user did not intend.

VirusTotal

64/64 vendors flagged this skill as clean.